0

I have a vm on which I'm trying to configure (unsuccessfully) one service per physical device - i.e. ssh open only on eth0, http only on eth1 and ftp only on eth2. This has to happen regardless on the physical device configuration so for example it has to work if eth0,eth1 and eth2 are all using DHCP on the same subnet as well as in the case eth0 is on one, eth1 using DHCP on another, etc.

The first try was to use the device (-i eth0) to filter out the traffic in iptables however it turns out due to how the kernel operates ssh will become open on eth1 and eth2 as well (packets are accepted on interface with a different IP). Switching to use IP filtering (-s x.y.z.q) does not work properly because the tables need to be updated every time the DHCP info changes.

I'm open to any suggestions on how to get this going, I've tried NAT-ing to a virtual interface which has static IP, bridges, etc all without any success.

UPDATE1: I did not mention but by using the IP (-s x.y.z.q) and setting arp_filter to 2 (RFC3704 Loose Reverse Path) I get one service per device however I need to keep the firewall in sync with the actual IPs of the devices and that has proven to be really finicky.

4
  • How about filtering based on both interface and destination address, to verify that the traffic for a given IP is coming in the correct interface? Also, how about having the services listening only on the correct IP instead of using iptables? Nov 21, 2014 at 0:16
  • Also what chain are you appending in Iptables? You may need to use the FORWARD chain to ensure the proper interface listens. My professor lectured on Iptables and really only had us do INPUT and OUTPUT chains in the Filter table since we were doing just a single NIC. He mentioned using FORWARD when having multiple NICs. This may help as well... thegeekstuff.com/2011/01/iptables-fundamentals Nov 21, 2014 at 2:55
  • It's not pretty, and more of a hack but you could use dummy (literally called "dummy") interfaces and DNAT+forward only from the specified external interface to your internal dummy listener. Bind the service to the dummy IP. You may have to eat up some private IP space to do it. Drop broadcast packets destined to your service ports. You could also use linux containers and a tap bridge to contain which interfaces the service has access to. Nov 21, 2014 at 4:33
  • This doesn't sound like an iptables problem for me. It sounds more like a 'service configuration' issue. Are the physical devices located on the same subnet, or are they attached to different subnets?
    – pepoluan
    Jan 2, 2015 at 7:39

1 Answer 1

1

Your model opens up a raft of routing and configuration issues. Having distinct DNS entries for each service all resolving to the same IP address would be much more workable approach. It is common for DNS names like smtp.example.com, ftp.example.com, ssh.example.com, and others all returning the same IP address.

These services all use distinct ports which allow them to run on the same interface. iptables can firewall by service, and if need be destination address. The addresses can be on the same interface or different interfaces. I haven't found a solution that would allow DHCP to provide multiple addresses for one interface.

2
  • This for a so-called "software appliance" and the guarantee needs to be if the NIC is not connected the service is not accessible.
    – pba
    Nov 21, 2014 at 3:37
  • @pba How do you guarantee that if the NICs are plugged into different network segments you don't create a bridge? Why do I need to dedicate a router port per service? I don't think I would be comfortable attaching a devices using this model to a network I had control of.
    – BillThor
    Nov 22, 2014 at 0:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .